Misc.BinToTerm with [:safe] option

[mhanberg]

The OTP docs imply that the :safe option will stop the creation of new functions, but the Sobelow docs imply it won't.

I tested with OTP 25, and it seems be safe with regard to creating new functions.

Should sobelow still fail if you use the :safe option?

[realcorvus]

fn -> :hi end will produce the error you see, but I suspect its related to how the External Term Format works, and the anonymous function is being treated as an atom. Malicious functions can still be created:

% elixir -e ':erlang.term_to_binary(fn _ -> IO.puts("hi"); :ok end) |> then(&File.write!("func.bin", &1))'

% elixir -e 'File.read!("func.bin") |> :erlang.binary_to_term([:safe]) |> IO.inspect()'
#Function<42.3316493/1 in :erl_eval.expr/6>

The Paginator library ran into this exact issue in production - https://paraxial.io/blog/elixir-rce

It was fixed with Plug.Crypto.non_executable_binary_to_term/2. Sobelow should still fail on this it seems.

[mhanberg]

whoa, weird!

Just reproduced myself, thanks for looking into that!